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Abstract. We investigate the complexity of the model checking problem for intuitionistic 
and modal propositional logics over transitive Kripke models. More specific, we consider 
intuitionistic logic IPC, basic propositional logic BPL, formal propositional logic FPL, 
and Jankov's logic KC. We show that the model checking problem is P-complete for the 
implicational fragments of all these intuitionistic logics. For BPL and FPL we reach P- 
hardness even on the implicational fragment with only one variable. The same hardness 
results are obtained for the strictly implicational fragments of their modal companions. 
Moreover, we investigate whether formulas with less variables and additional connectives 
make model checking easier. Whereas for variable free formulas outside of the implicational 
fragment, FPL model checking is shown to be in LOGCFL, the problem remains P-complete 
for BPL. 



1. Introduction 

Intuitionistic propositional logic IPC (see e.g. [31]) goes back to Heyting and bases on 
Brouwer's idea of constructivism from the beginning of the 20th century. It can be seen as 
the part of classical propositional logic that goes without the use of the excluded middle 
a V -la. 

While it was originally conceived and is primarily of interest from a proof-theoretic point 
of view, IPC admits many sound and complete semantics, such as the algebraic semantics 
[29], the topological semantics [T7j, and the arithmetical semantics [7]. The most well known 
semantics for IPC is Kripke's possible world semantics [15]. As a matter of fact, already in 
the 1930s it was observed by Godel that IPC can be mapped to a fragment of the modal 
logic S4, which was later shown to be the modal logic of the class of transitive and reflexive 
Kripke frames [Hj. In this paper, we explore this Kripke semantics further. 

Whereas the complexity of the validity problem for IPC is deeply studied [25 } [28 l [22 l [T2] . 
the exact complexity of its model checking problem is open. Research on the complexity 
of model checking on Kripke models goes back to [101 [23] (where it is called determination 
of truth) and has been done for a variety of logics like dynamic logic and many temporal 
logics. It was recently shown that the model checking problem for IPC formulas with one 
variable is AC"'"-complete [19J. We investigate the complexity of model checking for different 
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intuitionistic logics and for related modal logics — their modal companions. Our central 
question is which ingredients (i.e. logical connectives, number of variables) are needed in 
order to obtain maximal hardness of the model checking problem. 

We consider the intuitionistic logics BPL (basic propositional logic ^32j), FPL (formal 
propositional logic [32]), IPC and KC (Jankov's logic, see [9]). All have semantics that is 
defined over Kripke models with a monotone valuation function and a transitive framqj (as 
for BPL) that distinguish on whether the frame is additionally irreflexive (FPL), reflexive 
(IPC), or a directed preorder (KC). The validity problem for all these logics is PSPACE- 
complete [251 HI EH], and the satisfiability problem is NP-complete for IPC and for KC, 
but in NC-^ for BPL and for FPL. These intuitionistic logics can be embedded into the 
modal logics K4, PrL (provability logic [.li i26j), S4, and S4.2, that are called the modal 
companions of the respective intuitionistic logic. The validity problem and the satisfiability 
problem is PSPACE-complete for all these modal logics [161124] . The PSPACE-completeness 
results mentioned also hold for the implicational fragment of intuitionistic logics [25^ |4l |28] 
resp. the strictly implicational fragment for the considered modal logics [2]. Also, the 
complexity of the validity problem for fragments of the considered logics with a bounded 
number of variables was investigated [271 [U [22] . Roughly speaking, the number of variables 
that is needed to obtain a PSPACE-hard validity problem depends on whether the semantics 
restricts the transitive frames (of the Kripke models) to be reflexive, irreflexive, or none of 
both. For intuitionistic logics, it is shown in [22] that on transitive and reflexive frames (IPC) 
one needs two variables to reach PSPACE-hardness for the validity problem, on transitive 
and irreflexive frames (FPL) one variable is necessary, and on arbitrary transitive frames 
(BPL) one comes out without variables at all. For their modal companions, the same 
bounds apply for transitive and irreflexive frames (PrL) [2^ and for arbitrary transitive 
frames (K4) [5j, but for transitive and reflexive frames (S4) already one variable suffices [5]. 
Notice that no PSPACE-hardness results are known for the implicational fragment with a 
bounded number of variables. 

The model checking problem is the following decision problem. Given a formula, a 
Kripke model, and a state in this model, decide whether the formula is satisfied in that 
state. For classical propositional logic, the model checking problem (also called the formula 
evaluation problem) can be solved in alternating logarithmic time [3]. Since the models for 
classical propositional logic can be seen as a special case of Kripke models that consist of only 
one state, we cannot expect such a low complexity for intuitionistic logics, where the models 
may consist of many states. For the considered logics, the upper bound P follows from |10] . 
In fact, this upper bound turns out to be the lower bound too — we show that the model 
checking problem for KC, IPC, BPL, and FPL is P-complete, even on the implicational 
fragments. We obtain the same bounds on the number of variables for the P-hardness 
of the model checking problem as for the PSPACE-hardness of the validity problem (see 
above) for the considered intuitionistic logics and their modal companions. Other than for 
the validity problem, we obtain P-hardness even on the implicational fragments of FPL and 
BPL with one variable. The PSPACE-hardness of the validity problem on these fragments 
is open. Since the implicational fragments of IPC and KC for any bounded number of 
variables have only a finite number of equivalence classes (see [30]), we cannot expect to 
get P-hardness of model checking on these fragments. We also consider optimality of the 
P-hardness results in the sense whether model checking with less variables has complexity 
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below p. We show that model checking for the variable free fragment of FPL drops to 
LOGCFL, whereas for BPL one can trade the variable in an V and keeps P-hardness. 

Our results base on a technique we use to show that the model checking problem for 
the implicational fragment of IPC is P-hard. The variables we use in our construction are 
essentially needed to measure distances in the model and to mark a certain state. In order 
to restrict the use of variables, it suffices to express these in a different way. This takes 
different numbers of variables in the different logics according to their frame properties. 

This paper is organized as follows. In Section [2] we introduce the notations for the 
logics under consideration, and we show P-completeness of a graph accessibility problem for 
a special case of alternating graphs that will be used for our P-hardness proofs. In Section [3] 
we consider model checking for the intuitionistic logics KC, IPC, FPL, and BPL. It starts 
with the P-hardness results (Section 13. ip . and closes with the optimality of bounds on the 
number of variables needed to obtain P-hardness (Section 13. 2p . In Section U] the results for 
the modal companions S4.2, S4, PrL, and K4 follow. The arising completeness results and 
conclusions are drawn in Section [5j An overview of the results is given in Figures [7] and [HI 

2. Preliminaries 

Kripke Models. We will consider different propositional logics whose formulas base on a 
countable set PROP of propositional variables. A Kripke model is a triple A4 = {U,R,S,), 
where [/ is a nonempty and finite set of states, Ris a binary relation on U, and ^ : PROP — )• 
*P([/) is a function — the valuation function. For any variable it assigns the set of states in 
which this variable is satisfied. {U, R) can also be seen as a directed graph — it is called a 
frame in this context. A frame {U, R) is reflexive, if (x, x) a R for all x G [/, it is irreflexive, 
if (x, x) ^ R for all x G C/, and it is transitive, if for all a,b,c (z U, it follows from (a, 6) E i? 
and (6, c) G R that (a, c) & R. A reflexive and transitive frame is called a preorder. If a 
preorder (U, R) has the additional property that for all a,b € U there exists a c £ U with 
(a, c) € R and (6, c) G R, then (U, R) is called a directed preorder. 

Modal Propositional Logic. The language M.C of modal logic is the set of all formulas 
of the form 

ip ::= ^ \ p \ If ^ ip \ Oip , 

where p G PROP. As usual, we use the abbreviations -ic^ := (/^ — )> _L, T := -i_L, ipy ip := 
(-193) -^ Ip , ip A ip := -1(99 -^ ^ip), and Oip := -iD-k/j. 

The semantics is defined via Kripke models. Given a Kripke model A4 = {U,R,^) and 
a state s (z U, the satisfaction relation for modal logics \=m is defined as follows. 

M,s^^± 

M,s^„,p iff s G ({p), p G PROP, 

M,S^rr,V^'>P iff M,S^rr,^OT M,S^ry,'tp, 

M, s \=n, Oip iff yteU with {s, t) e R: M,t\=rn(p. 

For A4, s \=m f we say that formula ip is satisfied by model A4 in state s. 
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The modal logic defined in this way is called K and it is the weakest normal modal 
logic. We will consider the stronger modal logics K4, S4, S4.2, and PrL. The formulas in 
all these logics are the same as for MC. Since we are interested in model checking, we use 
the semantics defined by Kripke models. They will be defined by properties of the frame 
([/, R) that is part of the model. The semantics of K4 is defined by transitive frames. This 
means, that a formula a is a theorem of K4 if and only if TW, u; |=m ol for all Kripke models 
Ad whose frame is transitive and all states w oi M.. The semantics of S4 is defined by 
preorders, of S4.2 by directed preorders, and of PrL by transitive and irreflexive frames. 

Intuitionistic Propositional Logic. The language TC of intuitionistic logic is essentially 
the same as that of classical propositional logic, i.e. it is the set of all formulas of the form 

(/? ::= ± \ p I Lp/\ip I ip\/ if I 93— >c/?, 

where p G PROP. As usual, we use the abbreviations -199 := c^ — > ± and T := -i±. Because 
of the semantics of intuitionistic logic, one cannot express A or V using implication and _L. 
Therefore we use — > instead of — >■. 

The semantics is defined via Kripke models M. = (U, < , ^) that fulfil certain restrictions. 
Firstly, is transitive, and secondly, the valuation function ^ : PROP — ?• ^(U) is monotone 
in the sense that for every p € PROP, a,b € U: if a G ^(p) and a <b, then b € S,{p)- 
We will call models that fulfil both these properties intuitionistic or model for BPL. An 
intuitionistic model Ai = (C/, 0,^) where <i is additionally refiexive (i.e. is a preorder) is 
called a model for IPC. If is a directed preorder, then A4 is called a model for KG, and 
if <i is irreflexive, A4 is called a model for FPL. 

Given an intuitionistic model AA = ([/, < , ^) and a state s G U, the satisfaction relation 
for intuitionistic logics \=\ is defined as follows. 



seCip), PGPROP, 

AA,s \=\ if and Ai,s \=\ ip, 

A4,s \=\ If or A4,s \=\ tp, 

Mn € U with s <in : \i A4.^n\=\ ip then Ad,n\=\ ip 

An important property of intuitionistic logic is that the monotonicity property of the valua- 
tion function also holds for all formulas ip: \i A4.,s \=\ ip then Vn with s<in holds Ai,n \=\ ip. 
A formula (p is satisfied by an intuitionistic model AA in state s if and only \{ Ai,s \=\ ip. 
Basic propositional logic BPL [32j (resp. IPG, KG, FPL [32j) is the set of Z>C-formulas that 
are satisfied by every model for BPL (resp. IPG, KG, FPL) in every state. 

Modal Companions. Godel-Tarski translations map intuitionistic formulas to modal for- 
mulas in a way that preserves validity in the different logics. We take the translation 1 from 
|32j . that we call gt and that is defined as follows. 



X,sh^ 




A4,s^\p 


iff 


AA,s \=\ Lp ^'lp 


iff 


7W,s |=i v3 V V' 


iff 


X,s ^i 99 -> V" 


iff 
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Figure 1: Intuitionistic logics, their modal companions, and the common frame properties. 



9t{^) 


= _L 


9t{p) 


= p^Up (for all p G PROP) 


gt{a A /3) 


= gt{a)hgt{p) 


gt{a V /?) 


= gt{a)ygt{f3) 


gt{a ^ /3) 


= U{gt{a)^gtm 



Visser [32] showed that a is valid in FPL if and only if gt{a) is valid in PrL. Therefore, 
PrL is called modal companion of FPL. It is straightforward to see that gt can also be used 
to show that K4 (resp. S4, S4.2) is a modal companion of BPL (resp. IPC, KC). Figured] 
gives an overview of the intuitionistic logics and their modal companions used here. 

Model Checking Problems. This paper examines the model checking problems L-KMc 
for logics L whose formulas are evaluated on Kripke models with different properties. 

Problem: L-KMc 

Input: (99, A^, s), where 

c/3 is a formula for L, M = {U, R, S,) is a Kripke model for L, and s (z U 
Question: Is ip satisfied by ^A in state s? 

We assume that formulas and Kripke models are encoded in a straightforward way. This 
means, a formula is given as a text, and the graph ([/, R) of a Kripke model is given by 
its adjacency matrix that takes |C/p bits. Therefore, only finite Kripke models can be 
considered and it can be easily decided whether the model has the order property for the 
logic under consideration. 

Complexity. We assume familiarity with the standard notions of complexity theory as, 
e.g., defined in [20]. The complexity classes we use in this paper are P (polynomial time) 
and some of its subclasses. LOGCFL is the class of sets that are logspace many-one reducible 
to context-free languages. It is also characterized as sets decidable by a nondeterministic 
Turing machine in polynomial time and logarithmic space with additional use of a stack. 
L denotes logspace, and NL nondeterministic logspace. To round off the picture, NC-^ (= 
alternating logarithmic time) is the class for which the model checking problem for classical 
propositional logic is complete [3j, and the model checking problem for IPCi is complete 
for AC^ (= alternating logspace with logarithmically bounded number of alternations) |19j . 
The inclusion structure of the classes under consideration is as follows. 

NC^ C L C NL C LOGCFL C AC^ C P 
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Fisher and Ladner [10] showed that model checking for modal logic is in P. 
Theorem 2.1. p^ K-KMc is in P. D 



The notion of reducibility we apply is the logspace many-one reduction <m^. The Godel- 
Tarski translation gt can be seen as such a reduction between the model checking problems 
for intuitionistic logics and their modal companions, namely BPL-KMc <m^ K4-KMc, 
IPC-KMc <m^ S4-KMC, KC-KMc <m*^ S4.2-KMC, and FPL-KMc <m^ PrL-KMc. Since gt 
does not introduce additional variables, the respective reducibilities also hold for the model 
checking problems for formulas with any restricted number of variables. It therefore follows 
from Theorem 12.11 that P is an upper bound for all model checking problems for modal 
respectively intuitionistic logics considered in this paper. 

Fragments of Logics. We consider fragments with bounded number of variables or — > 
as only connective. The implicational formulas are the formulas with — > and _L as only 
connectives. For an intuitionistic logic L, we use L~* to denote the implicational formulas 
of L, i.e. its implicational fragment. Li denotes its fragment with i variables., i.e. the formulas 
of L with at most i variables. Lp denotes the implicational fragment with i variables. For 
modal logics, the (strictly) implicational fragment consists of formulas of the form 

if ::= ± I p I □((/?^ ^). 

We use the same notation for implicational fragments of modal logics (resp. with bounded 
numbers of variables) as for intuitionistic logics. 

The Godel-Tarski translation gt does not translate formulas of the implicational frag- 
ment of intuitionistic logics into the strictly implicational fragment of modal logics. For the 
model checking problem, we can use a different translation that preserves satisfaction but 
does not preserve validity. Let gt' be the translation that is the same as gt but gt'{p) = p 
for every variable p. 

Lemma 2.2. Let a he anXC-formula, and M he an intuitionistic model with state s. Then 
A4,s \=\ a if and only if M.,s \=m gt'{a). If a is an implicational formula, then gt'{a) is 
strictly implicational. □ 

P-complete Problems. Chandra, Kozen, and Stockmeyer [6j have shown that the Al- 
ternating Graph Accessibility Problem Agap is P-complete. In [Ij it is mentioned that 
P-completeness also holds for a bipartite version. 

An alternating graph G = (F, E) is a bipartite directed graph where y = V3 U Vy are 
the partitions of V . Nodes in V3 are called existential nodes, and nodes in Vy are called 
universal nodes. The property apathQ{x,y) for nodes x,y £ V expresses that there exists 
an alternating path through G from node x to node y, and it is defined as follows. 

1) apathQ^Xjx) holds for all x G ^ 
2a) for X € V3: apathQ{x, y) if and only if Bz G Vv : (x, z) £ E and apathQ{z, y) 
2b) for X € V\/: apathQ{x, y) if and only if Vz € V3 : if (x, z) £ E then apathQ{z, y) 

The problem Agap consists of directed bipartite graphs G and nodes s, t that satisfy the 
property apathQ(s,t). Notice that in bipartite graphs existential and universal nodes are 
strictly alternating. 
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Problem: Agap 

Input: {G,s,t), where G is a directed bipartite graph 

Question: does apathQ{s,t) hold? 

Theorem 2.3. PE] Agap is P -complete. D 

For our purposes, we need an even more restricted variant of Agap. We require that 
the graph is sliced. An alternating slice graph G = iV, E) is a directed bipartite acycHc 
graph with a bipartitioning 1/ = V3 U Vy, and a further partitioning y = Vi U V2 U • • • U Vm 
{m slices, Vi {^Vj = % li i ^ j) where 

V3 = U Vu 

i<rn,i odd 

^V = U Vi, and 

i<m,i even 

E CI y Vi X Vi+i, i.e. all edges go from slice Vi to slice Fj+i. 

i=l,2,...,m-l 

Finally, we require that all nodes in a slice graph excepted those in the last slice Vm have 
outdegree > 0. 

Problem: AsAgap 

Input: {G, s, t), where G = (V3 U V\/, E) is a slice graph with slices Vi, . . . , Vm., 

and s G Vi n ^3, t e Fm n Fy 
Question: does apathQ{s,t) hold? 

It is not hard to see that this version of the alternating graph accessibility problem remains 
P-complete. 

Lemma 2.4. AsAgap is P-complete. 

Proof sketch. AsAgap is in P, since it is a special case of Agap. In order to show P- 
hardness of AsAgap, it suffices to find a reduction Agap <m^ AsAgap. For an instance 
(G, s, t) of Agap with graph G = iV.E) where F = V3 U Vy has n nodes, we construct an 
alternating slice graph G' = iy' , E') with m = 2n slices as follows. Let V/ = {{v,i) | f G V} 
for 1 < f < m, V^ = IJ- Q^j V-, and Vy = |J- ^^^^ V-. The edges outgoing from a shoe Vi for 
odd i < n (existential slice) are 

E'i = U{u,i),{v,i + l)) {u,v) e E andu£ V3- {t}\ U U{u,i), {u,i + 1)) u€ Vy[J{t}\ 

and for even i (universal slice) accordingly 

E'i = U{u,i),{v,i + 1)) {u,v) eE andue V^/- {t}\uU{u,i), {u,i + l)) u € FgUltjj . 

Then G' = {V^ U Vy, E[L) ■ ■ ■ L) E'^_i). The transformation from G to G' can be com- 
puted in logarithmic space. It is not hard to see that {G, s, t) G Agap if and only if 

(C, (s, 1), (t, m)) £ AsAgap. D 
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Our basic P-hardness proofs of model checking problems will use logspace reductions 
from As Agap. The structural basis can be seen in the proof of the folklore result about Kg — 
the fragment of modal logic without variables — that we extend to the strictly implicational 
fragment K(^. 

Theorem 2.5. The model checking problem for K^ is P-hard. 

Proof. First, we give a straightforward transformation from AsAgap to Kq-KMc. Second, 
we turn this into a reduction from AsAgap to K(^-KMc. 

Let {G, s, t) be an instance of AsAgap, where G = {V, E) is a slice graph with m slices. 
We construct the model A^G := (^, ^U{(t,i)},0 and the formula (/?g := ODO • • • □♦(OT) 
that consists of a sequence of m — 1 alternating modal operators starting with O that is 
followed by OT. Notice that t is the only state in Vm that has a successor, and therefore 
it is the only state in Vm where OT is satisfied. Intuitively speaking, the prefix of OT in 
99g that consists of alternating modal operators simulates the alternating path through G 
from s, and eventually OT is satisfied on all the endpoints of this alternating path only 
if all endpoints equal t. It is not hard to see that an alternating path from s to t exists 
in G if and only if M.g-,s \=m ^g-, i-e- {G,s,t) G AsAgap if and only if Mg^s \=m ^g- 
Accordingly, {G, s, t) G AsAgap if and only if Mg, s \=m ^^G, where AsAgap denotes the 
complement of AsAgap. 

We now transform ^(fG into an equivalent formula in the strictly implicational frag- 
ment. Using duality of O and □ we obtain that -lODO • • • nO(C>T) is equivalent to 
D-iD-iD • • • -in-in(n_L). Every subformula □-■« is equivalent to □(« — > _L), and the fi- 
nal n(n_L) is equivalent to □(T — > □(T — )• _L)), where T = □(_L — > _L). In this way, -'ifc 
can be transformed into the equivalent formula ^p'q that belongs to the strictly implicational 
fragment. It is straightforward that the mapping {G,s,t) i— )• {ip'q,Mg-,s) can be computed 
in logarithmic space. Since tp'Q contains no variables and belongs to the strictly implicational 
fragment, this yields AsAgap <m^ K^-KMc, and the P-hardness of K^-KMc follows from 
the P-completeness of AsAgap (Lemma 12. 4p and the closure of P under complement. □ 

In general, the slice graph is transformed into a frame (of a Kripke model) to be used 
in an instance of the model checking problem. Since the semantics of the logics under 
consideration is defined by Kripke models with frames that are transitive (and refiexive), 
we need to produce frames that are transitive (and refiexive). The straightforward way 
would be to take the transitive closure of a slice graph. But this cannot be computed 
with the resources that are allowed for our reduction functions, i.e. in logarithmic space. 
Fortunately, slice graphs can easily be made transitive by adding all edges that "jump" 
from a node to a node that is at least two slices higher. Clearly, the resulting graph is 
a transitive supergraph of the transitive closure of the slice graph. In order to make the 
reductions from AsAgap to the model checking problems work, the valuation function of 
the Kripke model and the formula that has to be evaluated have to be constructed in a way 
that "ignores" these edges that jump over a slice. 

Definition 2.6. Let V>j = Uj=j j+i m^' ^"^^ ^<i ~ Uj=i2 i^j- "^^^ pseudo-transitive 
closure of a slice graph G = {V,E) with m slices F = Vi U • • • U Vm is the graph G' = {V, E') 
where 



E' := E U [j,=l,2,...,m-2{V^Xy>^+2) 
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Figure 2: A slice graph and its pseudo-transitive closure 

The reflexive and pseudo-transitive closure of the slice graph G is the graph G" = {V, E") 
where 

E" := E' U {{u,u) \ueV} . 
An example for a slice graph and its pseudo-transitive closure is shown in Figure El 



3. Lower bounds for intuitionistic logics 

We investigate the complexity of the model checking problem for fragments of the intu- 
itionistic logics KC, IPC, FPL, and BPL in Section 13.11 Our basic proof idea is presented 
in the proof of Theorem 13.11 where we show the P-hardness of KC^-KMc. This hardness 
result carries directly over to IPC^-KMc and BPL~^-KMc. In order to obtain results for 
fragments with a restricted number of variables we extend the construction from the basic 
proof. In a first step, we show the P-hardness of model checking for FPL~^ even if we 
consider formulas with only one variable, i.e. FPLj*-KMc. The same proof works for the 
P-hardness of BPL{*-KMc. In a second step, we yield P-hardness of BPLq-KMc. Notice 
that it remains open whether BPL^-KMc is P-hard, too. Our last P-hardness result in 



Section [3T] shows that KC2-KMC and IPC2-KMC are P-hard. In Section [32] we show that 
the results for FPL^^-KMc, KC2-KMC, and IPC2-KMC are optimal in the sense, that with 
one variable less the model checking problem cannot be P-hard, unless unexpected collapses 
of complexity classes happen. 



3.1. P-hard fragments. 

We present the basic construction in the proof of Theorem 13.11 where we show the P- 
hardness of the model checking problem for the implicational fragment of KC. For this, 
we use a logspace reduction from AsAgap to KC~*-KMc. The P-hardness of the model 
checking problems for the implicational fragments of IPC and BPL follow straightforwardly. 

Theorem 3.1. The model checking problem for KC~* is P-hard. 

Proof. We show AsAgap <m^ KC~^-KMc. The result then fohows from Lemma [2^ 

Let {G,s,t) be an instance of AsAgap. We show how to construct a model A4g ^ind 
a formula ipc such that {G,s,t) € AsAgap if and only if Mg,s \=\ tpc- Let the slice 
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graph G = (V, E) have m shces, with V = V3 U Vv, and V3 = Vi U V3 U • • • U Vm-i, and 
l/y = 1/2 U 14 U • • • U Ki. We use V>i to denote Uj>j Vj- 

In order to use G as a frame of a model for KC, it must be a directed preorder. To get 
{V, ^) we build the pseudo-transitive closure of G, add the slice Vm+i '■= {top}, add edges 
from every node in V to top, and build the reflexive closure. It is clear that (V, ^) can be 
computed from G in logarithmic space. For simplicity of notation we write x < y 01 y > x 
for X ^ y and x ^ y, and we also use x ^ y and a; > y in the same way. The variables 
that we will use in our formulas are ai, . . . , a.m+i. Informally, Oj is satisfied in the states of 
the slices Vi+i, . . . , Vm+i, further Um is satisfied in the goal node t, and Om+i is satisfied in 
top. Define the valuation function ^ by ^(flj) := Vj+i U ■ ■ ■ U Vm+i (for i = 1,2, . . . ,7n — 1), 
^{am) '■= {t,top}, and ^{am+i) '■= {top}. The Kripke model A4g = (y,^,0 is a model 
that satisfies the requirements for KC. 

slice V5: ai,a2, a^, 04, 05 

) slice V4: ai, a2, 03 

) slice V3: ai, 02 

slice V2: ai 

3 ( s J Graph G ( s T Kripke model Mg slice Vi: no variable is satisfied 

Figure 3: A slice graph G, and the model A4g as constructed in the proof of Theorem 13.11 
The edges to the top node are not drawn, reflexive edges are not drawn, and the 
pseudo-transitive edges are drawn dashed. The valuation marks the nodes (resp. 
the slices). The fat edges indicate that apathQ{s,t) holds. 

Figure [3] shows a slice graph G with m = 4 slices and the Kripke model Mq that is 
transformed from it. We will use the formulas if^i,... ,'ijjrn in order to express the apathQ 
property on M^g- 

Wm ■ — Oi-m ^ Oifn+l 

ipj := V'i+i ~^ Oj for j = m — \,m — 2, . . . ,\ 

Next we will show that satisfaction of V'j in slice Vi depends only on the edges of the graph 
G and not on the reflexive and pseudo-transitive edges that were added in order to obtain 
the Kripke structure. 

Claim 1. For all i = 1, 2, . . . , tti — 1 the following holds. 

(1) For all w G V>j+i holds M.GiW \=\ ipi. 

(2) For all w £ Vi holds Mg,w \=\ il^i if and only if M.g, w ^i V'j+i- 

(3) For all w ^Vi holds Mg-, w \=\ ipi if and only ii 3u > w,u & V^+i : A4g, u ^\ V'i+i- 
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Proof of Claim. For part ([T]), notice that ipi = {■■■{{am — ^ Om+i) — ^ CLm-i) —>■■■—> 
Oj+i) — > aj. Since S,{ai) = V>i+i, the right-hand side of V'j is satisfied in all states in V^i. 
Therefore V'j is satisfied in all states in V>i, too. 

Part ([2]) expresses that ipi and ipi+i behave like the mutual complement in slice Vi, and 
is shown as follows. Let w &Vi. 

Mg,w \=\ ipi 

<^ Mv ^ w : \i Mg^ "v \=\ tpi+i then Aic, ^ \='\ o,i (semantics of ->) 

<^ if Mg, w \=\ ipi+i then Mg,w \=\ ai (since ^(cj) = V^i) 

44> Mg,w ^-.ipi+i {since Mg,w ^\ai) 

Part ([3|) can be proven by proving A^cw ^\ ipi+i if and only ii3u > w,u £ Vi+i : 
A^G,ii ^i V'i+ii according to ([2]). The direction from right to left follows immediately 
from part (1) and the monotonicity of intuitionistic logic. For the other direction, assume 
yu > w,u £ Vi+i : M-G^u \=\ tpi+i. Firstly, this yields \/u > w : if Mg^u \=\ il^i+2 then 
A^Gi^i \=\ Oj+i (**)i and secondly \/u > w,u £ Kj+i : ^AG,u ^\ ipi-\-2 (by (HJ). From the 
latter, it follows by the monotonicity property of intuitionistic logic that M.g^'w ^\ V'i+2- 
Notice that M.g^'w ^\ flj+i by construction of ^, and therefore we have: if ^AG,w \=\ V'i+2 
then A4g,w \=\ Oj+i. Together with (**) follows Vu^ w : ii Mg^"^ \=\ '^i+2 then A^cu ^j 
Oj+i. This means M.GiW \=\ ■0i+i. ■ 

It is our goal to show that "01 is satisfied in state s G Vi if and only if graph G has an 
alternating s-t-path, i.e. apathQ{s,t). We do this stepwise. 

Claim 2. For all i = 1, 2, . . . , m and all w £Vi holds: 

(1) if i is odd: apathQ{w,t) if and only if A^ctu |=i -04, and 

(2) if i is even: apathQ{w, t) if and only if Mg^ w y=\ ipi. 

Proof of Claim. We prove the claim by induction on i. The base case i = m considers an 
even i. Let w € Vm- The following equivalences are straightforward. 

apathQ{w,t) 
<^ w = t 

<^ Mg,W ^i am -> fflm+l (= 1pm) 

For the induction step, consider i < m. First, assume that i is odd. Then the slice Vi 
consists of existential nodes. Let w £Vi. 

apathQ{w,t) 

<^ 3u, {w,u) S E : apathQ{u,t) (definition of apatho) 

<^ 3u> w,u £ Vi+i : M.G,u ^i 'ipi+i (induction hypothesis, construction of A^g) 

^ MG,w^iipi (ClaimdllSD) 

Second, assume that i is even. Then the slice Vi consists of universal nodes. Let w €Vi. 
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apathQ{w,t) 

4^ Vu, {w,u) G E : apathQ^Ujt) (definition of apathQ) 

■^ Vu > WjU £ Vi+i : A4g,u \=\ tpi+i (induction hypothesis, construction of A4g) 

^ Mcw^ii^i (Claim dllSD) ■ 

Let ipG '■= ■^i- From Claim [2] it now follows that {G,s,t) € AsAgap if and only if 
M-GtS \=\ '4)G, i-e. (-00) ■^G)'?) G KC~^-KMc. Since M.g and t/^g can be constructed from 
G using logarithmic space, it follows that AsAgap <m^ KC~*-KMc. D 

Clearly, the same lower bound holds for the implicational fragments of IPC and BPL. 

Corollary 3.2. The model checking problem for IPC^ and BPL^ is P-hard. □ 

The basic construction of the reduction from the above proof can be seen as follows. The 
frame of the model contains all information about the AsAgap instance from which it is 
constructed, but there is some "noise" by the pseudo-transitive (and reflexive) edges. The 
valuation function gives additional information on the structure of the AsAgap instance. 
It says where the goal node t sits, and it allows to check the distances of any state to the 
upper most slice. The formula puts both parts together. It uses the variables to filter out 
the original AsAgap instance and to evaluate it. 

If we restrict the number of variables to be used in the formula, we need a different 
approach to measure the distances of the states to the upper most slice. For irrefiexive 
frames, we can replace the variables by formulas that measure this distance. To distinguish 
the goal node from the other nodes we use one variable. This yields that FPL^-KMc is P- 
hard (Theorem l3.3p . In Theorem 13. 71 we show that we cannot save this variable. Essentially, 
in the fragment of FPL without variables we can measure distances, but we cannot do more. 

Theorem 3.3. The model checking problem for FPL^ is P-hard. 



-log 



Proof We show AsAgap <m FPL^-KMc, where AsAgap is the complement of AsAgap. 
Since P is closed under complement, from Lemma 12.41 follows that AsAgap is P-complete. 
Therefore we obtain the P-hardness of FPL^-KMc. 

Let {G,s,t) with G = {V,E) be an instance of AsAgap with m slices. From that 
we construct an FPL]^-KMc instance {ip,Ad,s). Let p be the variable that is used in 
FPL]^. Let iy,^) be the pseudo-transitive closure of G (see Definition 12. 6p . We define 
M. := (y, -<,C) with ^{p) := {t}. We use p to distinguish t from the other states in slice 
Vm ■ Figure U] shows an example of A4 with m = 4. 

To express the apathQ property we use the formulas ■0^) V'm-ij • • • j V'l defined as follows. 



"m ■'■ 


= ^, 




i'm ■■■■ 


= P 


Oi :■- 


= T- 


^> Cki+l, 


Ipi ■■■■ 


= V'i+i 



Oj+i for i = m — l,m — 2, . . . ,1 

Note that the length of "01 is approximately the sum of the lengths of all Oj with m > i > 1, 
hence it is about m^. We use the Oj formulas as yardsticks for the slices and the ipi formulas 
for the alternation as we did in the proof of Theorem 13.11 According to Claim [1] we give the 
following claim. Because of the irreflexivity of Ai we do not need the mutual complement 
property (Claim [H2)). 

Claim 3. For all i with m > i > 2 it holds that 
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(1) M.,w \=\ Oi if and only if u; G V>i+i, and 

(2) for all w G Vi_i it holds that Ad^w ^\ ipi-i if and only if 3v G Vi,w ^ v : M.,v \=\ ipi. 

Proof of Claim. With induction on i we show (1). For i = m it is trivial because am = -L- 
For the induction step let w &W and m > i >2. 

M,w \=i ai (= T -0 Oj+i) 
44> yv &V,w ^ V : M.,v \=\ Oj+i (semantics of — >) 
<^ yv gV,w ^ V : V & V>i+2 (induction hypothesis) 

<^ w G V>i+i (construction of M.) 

For (2) consider w G Vi-i with m > i >2. 

M,w ^i Vi-i (= V'i -^ "i) 
<^ 3v gVjW ^ V : M.,v \=\ Ipi and ^A,v Y=\ on (semantics of — >) 
<^ 3v eVi,w ^v : M,v \=\'il^i (ClaimEi;!)) ■ 

According to Claim [2] we have a similar connection between apathQ and the ipi formulas. 

Claim 4. For all i = m, m — 1, . . . , 1 and all w aVi it holds that: 

(1) if i is even: apathQ{w, t) if and only if MjW \=\ ipi, and 

(2) if i is odd: apathQ{w, t) if and only if MjW ^\ ipi. 

Proof of Claim. We prove this claim by induction on i. The base case i = m considers an 
even i. Let w G Vm- The following equivalences are straightforward. 

apathQ{w,t) 

<^ w = t 

<^ M,'w \=\p 

The induction step is with the help of Claim [3] similar to the induction step in the proof of 
Claim [21 (Note that the roles of the even and odd slices are swapped.) We consider i < m. 
First, assume that i is even. Then the slice Vi consists of universal nodes. Let w ^Vi. 

apathQ{w,t) 
<^ Vw G F, (w, v) £ E : apathciv, t) (definition of apathQ) 

4^ Vii G Vi+i,w ^ V : M^,v ^\ ipi+i (induction hypothesis, construction of 7W) 
<^ M,w^iipi (Claim [3i;2)) 

Second, assume that i is odd, then the slice Vi consists of existential nodes. Let w £ Vi. 

apathQ{w,t) 

4^ 3v € V, {w,v) G E : apathG{v,t) (definition of apatho) 

<^ 3v £ Fi+i, w ^ V : M., V \=\ tpi+i (induction hypothesis, construction of Ai) 

4^ M,w^i^i (Claim[3i;2)) ■ 
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F^i p for u ^ t 




_L for g with apathQ{g,t) 

_L for u with nof apathQ(u,t) 



for 5 with apathQ{g,t) 
for w with not apathQ{u,t) 



s ^i ((p - ±) - (T - ±)) ^ (T - (T - ±)) 



Figure 4: The model Ai as constructed from the example instance of AsAgap in Fig. [3] 
by the proof of Theorem 13.31 For simplicity, the pseudo-transitive edges are not 
drawn. 



Let V) := ■i/'i- It follows from ClaimHthat M,s\=\'4) (resp. {ifj^M, s) G FPL^^-KMc) if 
and only if (G, s, t) ^ AsAgap. Since M and ip can be constructed from G using logarithmic 
space, it follows that AsAgap <m*^ FPL^^-KMc. D 

Corollary 3.4. The model checking problem for BPL^ is P-hard. □ 

For the fragment of BPL without variables, we can show the P-hardness of model 
checking only for formulas with the connectives — > and V. Our replacement technique for 
the last variable costs us the implicationality of the fragment. 

Theorem 3.5. The model checking problem for BPLq is P-hard. 



Proof. As in the proof of Theorem [331 we show AsAgap <m^ BPLq-KMc. The proof 
consists of two parts. In the first part we modify the construction that we gave in the 
proof of Theorem 13.31 in a way that the V'i formulas contain two variables but no _L because 
we need ±-free formulas for the second step. In the second step we use a technique from 
Rybakov [221 Lemma 8] to substitute the variables. 

Let {G,s,t) with G = {V, E) be an instance from AsAgap, {V,^) be the pseudo- 
transitive closure of G, and M. := {V,^,^) with CiPi) '■= {t} ^-iid ^(^2) := 0- Informally, 
P2 plays the role of _L because for all w G V it holds that M,w ^i p2. We define the ipi 
formulas as mentioned above. 

6m ■■= P2, 1pm ■■= Pi 

6i ■■= T->6'j+i, ipi := ipi+i ^ 9i+i for i = m- l,m - 2. . . ,1 

For the same reason as in the proof of Theorem 13.31 it holds that 

A4,s|=iVi <^ (G, s,i) ^ AsAgap. 

The models 5i = iWi,Ri) for i = 1,2,3 and the formulas /3i and /32 are defined as in the 
proof of Lemma 8 in [22J. Let for k = 1, 2, 3 
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^i as -* a2 

^i (q;2 -> q;i) Vas 




^i 0:4 -i> 0:3 




Figure 5: The models ^i, ^2, and 5^3. (Transitive edges are not depicted.) It is drawn which 
parts of /3i and /32 are satisfied and which are not. For example let w £ W* with 
{w,al) E R*, then it holds that ^*,w ^\ /3i. Therefore we connect via R* (resp. 
R^) every state from V\S,{p) with 03 and replace pi with Pi in •i/'i- The models 5^i 
and 5^2 simulate S, with technical help of ^3 . (For details see the proof of Lemma 
8 in [22|.) 



Wk := {bk,a'l,a^,...,a'^^2]^ ^T^'^ 

Rk ■■= {{bk,bk),{4+2^h)}^{{4,a';)\l<j<t<k + 2}. 

The models are depicted in Figure [5l The formulas /3i and /32 are defined as follows. We 
use the abbreviation ai := T — > ± and Oj+i := T — > qj for i > 1. 

Pi := (03 -> 02) -> ((02 -> ai) VQ3) 
/32 := (04 -> 03) -> ((03 -> 02) V 04) 
We define a BPLo-KMc-instance (V'/3,5^*,s) with d* = {W*,R*). 

W* := VUW1UW2UW3 

Ri := {{w,al),{v,al),{v,al)\weW\{t},veW} 

R* is the transitive closure of ^ U RiU R2U R'sU R^ 

Note that \Wi U W2 U W3I = 15 and -< is already transitive, hence one can compute the 
transitive closure in logarithmic space. (We give no valuation function because in BPLq 
models variables are irrelevant.) The connection between /3i and P2 and 5* is shown and 
explained in Figure [5j In the following we substitute the variables in ipi . 



tpp 



MPi/Pi]\P2/P2] 



As Rybakov did in the proof of Lemma 8 in [22] one can show by induction on the con- 
struction of V' that 



5*,s hiV/? ^ X,S^iVl- 
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(Note that Rybakov shows this only for _L-free formulas, hence we cannot use the one 
variable version of V'l from the proof of Theorem l3.31 ) It holds that {tp/3,d* , s) E BPLq-KMc 
if and only if {G, s,t) ^ As Agar. It follows directly from the construction that this is a 
logspace reduction. D 

Other than BPL,^ and FPL,j*, the implicational fragments of IPC with any bounded 
number of variables have only a finite number of equivalence classes (see [30]). Therefore 
they cannot express arbitrary distances in a model. We obtain P-hardness of model check- 
ing for the fragment of IPC with two variables, where the formulas consist of arbitrary 
connectives. The same applies for the fragment of KC with two variables. 

The proof uses our basic construction from the proof of Theorem 13.11 and essentially the 
same replacement of variables as in the proof of |22l Theorem 4] showing that the validity 
problem for IPC2 is PSPACE-complete. Whereas there the reduction works in polynomial- 
time (that suffices to compute transitive closures), our construction must be computable 
in logarithmic space, and therefore we must deal with the pseudo-transitive closure. Little 
other technical changes in the proof are needed. For completeness, we present the proof in 
Appendix [Al 

Theorem 3.6. The model checking problem for KC2 and for IPC2 is P-hard. □ 



3.2. Optimality of the bounds of the numbers of variables. 

The P-hardness of KC2-KMC and IPC2-KMC (Theorem [3^ is optimal because KCi-KMc G 
NC^ and IPCi-KMc € AC"^ [19j. In order to show the optimality of the P-hardness of 
FPL];*-KMc (Theorem [33D, we show that the complexity of FPLq-KMc is below P. 

Theorem 3.7. The model checking problem for FPLq is in LOGCFL. 

Proof. Visser [32] gives a systematically construction of representatives of the formula equiv- 
alence classes of variable free formulas over irreflexive Kripke models. This enables that 
every variable free formula can be represented by a small string. We call this string formula 
index. We will show that every state in an FPLq model can also be represented by the 
length of its longest outgoing path. It turns out, that a formula is satisfied in a state if and 
only if the formula index is greater than the length of the longest path that starts in the 
state. This yields a LOGCFL algorithm for the model checking problem for FPLq. 

The formula index of a formula is the index i of the FPLo-equivalenIo formula ctj from 
[321 Def. 4.3] defined as follows. Let i G N U {u}, where a; > z for all i G N. 

ao := _L, a^j := T, a^+i := T — > Oi for i G N. 

Claim 5. [32\ Fact 4.4(iii)] Every variable free IC formula is FPLo-equivalent to exactly 
one Oi. 

One can prove the claim with the following case distinction [321 Fact 4.4(ii)]. 



Two variable free IjC formulas tp and -0 are FPLo-equivalent if for all states w in all FPLo models A4 it 
holds that M,w \=i ip <^ Ai, w \=i il). We denote this as ip =p tp. 
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If (/3 = _L, then ip =p oq. 

lf(p=FaaAab, then (f =F a^m{a,b}■ 
Uip=F OaV at, then (^ =F amax{a,b}- 

ir ^, j V =F auj if a < 6 

It ip=F aa -> ab, then < 

I 9? =i? Ofo+i it a > 6. 

If ip =p ai, we call i the formula index of C/9. In order to analyse the complexity of the 
formula index computation, we define the following decision problem. 

Problem: EqVformula 

Input: {if, i), where (p is a variable free ZC formula and i € N U {uj} 

Question: Is Oj =p (/?? 

Claim 6. EqVformula is in LOGCFL. 

Proof of Claim. From the case distinction above one can directly form a recursive algorithm. 
If ip =F OLi it holds that i = a; or i < \p\. (\p\ denotes the length of p.) So every variable 
value can be stored in logarithmic space. The algorithm walks recursively through the 
formula and computes the formula index of every subformula once, hence running time is 
polynomial. All information that are necessary for recursion can be stored on the stack. 
Therefore the algorithm can be implemented on a polynomial time logspace machine that 
uses an additional stack i.e. a LOGCFL- machine (even without using nondeterminism) . ■ 
In the following we show that for model checking every FPLq model can be reduced to 
its longest path. Let Ai = (PF, R) be an FPLq model. (Note that we need no valuation 
function because in FPLq models variables are irrelevant.) Therefore we define a function 
^Pm : W^ ^ N that maps a state w to the length of the longest path in M. starting in w. 



IPMiw) 



0, [i$v(£W :{w,v) £ R 

max Upka(v)} + 1, otherwise 



Claim 7. 

(1) Let A4 = (W, R) be an FPLq model. For every Oi and every state w £ W it holds that 
Ad^w \=\ ai ii and only if lpj^{w) < i. 

(2) The following problem is NL-complete: given an FPLq model A4, an integer n, and a 
state w of Ai; does Ipj^iw) = n hold? 

Proof of Claim. We prove (1) with induction on the formula index i. The cases i = and 
i = ijj are clear. The induction step is shown by the following equivalences. 

A{,w |=i aj+i (= T -> ai) 

44> Vs G VF, (fw, s) £ R: Ai., s \=\ ai (semantics of — >) 

44> Vs € py, {w, s) £ R : lpj^{s) < i (induction hypothesis) 

44> lpj^{w) < i + 1 (irreflexivity of 7V4) 

For (2) note that the problem for a given graph G, a node s of G and an integer n to decide 
whether the longest path in G starting in s has the length n is NL-complete [13) . ■ 
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Algorithm 1 FPLq model checking algorithm. 



Require: a variable free XL formula 99, an FPLg model 7W, and a state w from M. 
1: guess nondeterministically a formula index i E {0, 1, . . . , \'~p'\) U {a;} 
2: if ((/9, i) G EqVformula then 
3: guess nondeterministically an integer n < i 

4: if Ip_m{w) = n then accept else reject 

5: else reject 

Algorithm [1] decides FPLq-KMc with the resources of LOGCFL. In the first two steps 
we compute the formula index of (p. With Claim [6] it follows that these steps can be done 
with the resources of LOGCFL. In the next steps the length of the longest path starting in 
w is guessed and verified. The verification (Step 4) can be done with the resources of NL. 
The correctness of Step 4 follows from Claim [5] and Claim [71 Altogether Algorithm [1] can be 
implemented on a nondeterministic polynomial time machine with logarithmic space and 
an additional stack. These are the resources of LOGCFL. □ 

It is not known whether FPLq-KMc is LOGCFL-hard, too. We show NL as lower bound, 
even for the implicational fragment. 

Lemma 3.8. The model checking problem for FPL^ is NL-hard. 

Proof sketch. Claim [7] shows that in FPLq only the depth of a model can be evaluated by a 
formula. Accordingly, the Oj formulas can be used to describe the maximal length of a path 
through a model. This yields a reduction from the longest path problem in acyclic directed 
graphs to FPL,^-KMc. Let {G = {V,E),v G y, n G N) be an instance of the longest path 
problem. Then it holds, that the longest path starting in v has the length n if and only 
if G,v \=\ Oj+i and G,v ^\ ai. This follows from Claim [Tl||l). Since NL is closed under 
complementation this is a correct reduction. For the N L-completeness of this longest path 
problem see [13]. D 

4. Lower bounds for modal logics 

For all P-hard model checking problems for fragments of intuitionistic logics we obtain the 
same lower bound for their modal companions. 

Theorem 4.1. The model checking problem is P-hard for K4o, PrL^^, S4.2^, K4]^, and 
S4^. 

Proof. By Lemma 12.21 this follows from Theorems 13. 5[ 13. 3[ and 13.11 □ 

From Theorem 13.61 and Lemma 12.21 we obtain that the model checking problem for 
S4.22 — the modal companion of KC2 — is P-hard. Even though model checking for KCi is 
in NC [H], we can show that one variable suffices to make model checking P-hard for S4.2. 

Theorem 4.2. The model checking problem for S4.2i is P-hard. 

Proof. We show that AsAgap <m^ S4.2i-KMc. Since AsAgap is P-hard (Lemma [O]) . the 
P-hardness of S4.2i-KMc follows. 

Let {G,s,t) be an instance of AsAgap, where G = (V3 U Vrf,E) is a slice graph with 
m slices, and ^3 = Fi U V3 U ■ ■ ■ U Vm-i, and Vy = V2 U V4 U • • • U Vm- We construct a 
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all nodes in Vi satisfy a 



all nodes in V2 satisfy a 



Figure 6: The model TWg as constructed in the proof of Theorem 14.21 for the ASAGAP 
instance from Figure [3l Pseudo-transitive edges and reflexive edges are not drawn 
for simplicity. The valuation marks the nodes (resp. the slices). The fat edges 
indicate that apathQ{s,t) holds. 



Kripke model Aic = {U, R, C) and a formula Ai such that {G, s, t) G AsAgap if and only 
if {Xi,M.G,s) E S4.2i-KMc. First, let Gt = (V,^) be the pseudo-transitive and reflexive 
closure of G. Second, we add two slices to Gt, namely Vm+i ■= {u, ti, t2} and Vm+2 '■= {top}. 
Third, we add the edges {{v, u) \ v G Vm} from every node in Vm to u, edges {{t, ti), (t, t2)} 
from the goal node t G Vm to ti and to t2, and edges {{u, top), {ti, top), (^2, top)} from every 
node in Vm+i to top. Moreover, in slice Vm+i we abstain from the rule that there are no 
edges between different nodes in the same slice. We also add the edges {(ii, ^2), (^25*1)} 
between ti and ^2 in both directions. Finally, we add pseudo-transitive edges V<rn-i x Vm+i 
and V<m X Vm+2, and reflexive edges to all nodes. Let the graph G' = {U,R) be the graph 
obtained in this way. Then G' is reflexive, transitive, and every node has an edge to top. 
Therefore, G' is a directed preorder. 

In order to be able to find out in which slice a state is, we mark every even slice 
^2) ^4, • • • ! Vm, Vm+2 with the variable a, and in slice Vm+i the node t2 is marked with a. 
This yields the valuation function ^ to be defined by ^(a) := V2 U V4 U • • • U Vm+2 U {^2}; 
and completes the construction of the Kripke model Mq '.= {U,R,S,). Figure [6] shows an 
example. 

Let rj := -la A 0(a A O^a). We will use that r] is satisfied in ti, but it is not satisfied in 
Vm U {u,t2, top}. The goal node t is the only node in slice Vm that has a successor (namely 
ti), in which r] is satisfied. We can estimate the slice to which a node belongs using the 
following formulas 6i. Let 5m '.= ^(~'^), and for i = m — 1, m — 2, . . . , 1 

I 0(-ia A (5i+i), if i is even, 
Oi := < 

I 0( a A6i+i), if i is odd. 



Claim 8. Let x G V<m and i = 1,2, . . . ,m. Then A4g,x |=m 5i if and only if a; G V"< 



<i- 
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Proof of Claim. We proceed by induction on i = m,m — 1,...,1. The base case i = m is 
clear, since -^rj is satisfied in u and every state in V<_rn has an edge to u. For the induction 
step consider an arbitrary i < m. Let i be odd and and x £ V<rn- If J^GiX |=m ^i, then 
X has a successor y with M.G-,y \=m a and Mg^V \=m <^i+i- By the induction hypothesis 
we obtain y £ V<i+i. li x ^ y, it follows by the properties of the slice graph that y is a 
successor of x in a slice "higher" than that of x. The case x = y \s not possible because 
Mg-,x |=m "'O and M.G,y \=m «• Therefore x G V<j. For the other proof direction, take 
any x € V<j. The formula 5i is satisfied in x, if there exists a path of length m — i-\-l from 
X to u in {U,R), that goes through states that alternatingly satisfy a and -la. This means, 
that no edge {v, v) appears on this path. Since every state in V<rn has a successor in the 
subsequent slice, such a path exists, and therefore J^g^x |=m 5j. For even i, the proof is 
similar. ■ 

The goal state t is the only state in Vm that satisfies Orj. Using the 6i formulas to 
verify an upper bound for the slice of a state, we can now simulate the alternating graph 
accessibility problem by the following formulas. 

Let Am '■= a A Or] and for i = m— l,m — 2,...,1 

J -la A 0((5j_|_i A Aj+i), if i is odd, 

Aj !^ \ 

I a A □((5j+i —^ Aj+i), if i is even. 

Claim 9. For i = 1,2, ... ,m and all x G V^ holds: apathQ{x, t) if and only if 7V4g, x \=m Aj. 

Proof of Claim. We prove the claim by induction on i and start with i = m. For all x G Vm 
holds M.G,x \=m Am if and only if x = t, where the latter is the same as apathQ{x,t). 
For the induction step, consider an odd i < m first and let x G V^. We get the following 
equivalences. 

apathQ{x,t) 
4^ 3(x,y) £ E : y £ Vi-^-i and apathQ{y,t) (definition of apatho) 

<^ 3{x,y) G R : Mg^V Nm ^i+i and Mg^V |=m A^+i (ind. hypoth.. Claim E]) 
44> M.G-,x \=m ^a A 0((5i+i A Aj+i) (= Aj) (construction of M.g) 

Second, consider an even i < m, and let x G V^. The following equivalences hold. 

apathQ{x,t) 
44> V(x,y) £ E: if y £ V^+i then apathQ{y,t) 
<» V{x,y) £ R: if MG,y \=m Si+i then MG,y \=m K+i 

<^ A^G,a: hm aAn(5i+i ^ Aj+i) (= Aj) 

The arguments for the equivalences are the same as above. ■ 

From Claim [9] it now follows that {G,s,t) £ AsAgap if and only if Mg,s |=m Ai, i.e. 
{\l,^AG, s) £ S4.2i-KMc. Since the construction of A4g and Ai from G can be computed 
in logarithmic space, it follows that AsAgap <m^ S4.2i-KMc. D 

Note that the reduction in the proof of Theorem 14.21 is not suitable for intuitionistic 
logics, since the constructed Kripke model lacks the monotonicity property of the variables. 
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Moreover, in that proof we make extensive use of negation, that would have a very different 
meaning in intuitionistic logics. 

Clearly, the same lower bound holds for the fragment of S4 with one variable. 

Corollary 4.3. The model checking problem for S4i is P-hard. □ 

The P-hardness results for S4.2i-KMc and S4i-KMc are optimal since the model check- 
ing problem for S4o is easy to solve. A formula without any variables is either satisfied by 
every model w.r.t. S4 or it is satisfied by no model. This is because OT (resp. DT) is 
satisfied by every state in every model, and 0_L (resp. D-L) is satisfied by no state in every 
model. Essentially, in order to evaluate a S4o formula in some model, the model and the 
modal operators can be ignored and the remaining classical propositional formula can be 
evaluated like a classical propositional formula — this problem is NC^-complete (see [3]). 

Lemma 4.4. The model checking problem for S4o and for S4.2o are HQ}-com,plete. □ 

According to Theorem l3.7l we show that the complexity of PrLg-KMc is below P, namely 
PrLg-KMc G AC-^. Therefore the P-hardness of PrL]^-KMc is optimal in the sense that we 
cannot save the variable. 

Theorem 4.5. The model checking problem for PrLo is in AC-*-. 

Proof. We show that every PrLg model can be reduced to its longest path. Therefore 
we define linear modelqj -C^ := ({0, 1, . . . ,n}, >) and use the function Ipj^, that maps a 
state to the length of the longest path in its model starting in this state (see the proof of 
Theorem l3.7p . (Note that we give no valuation function because in PrLg models variables are 
irrelevant.) Reinhardt [21] recently showed the upper bound AC-^ for PrLo model checking 
restricted to linear models. 

Claim 10. Let M = {W, R) be a PrLo rnodel, w G W , and ip a variable free MC formula. 
Then it holds that A^,u> |=m y? if and only if Cip^^i^^), Ipj^i"^) Nm f- 

Proof of Claim. We show this by induction on the construction ip. The case c/9 = _L is clear. 
In the induction step the case 92 = a — )• /? is straightforward. Assume that p = Da. 

M,w \= if {= □«) 

<^ ^v € W, {w, v) & R : M..,v \=m ot (semantics of □) 

<^ Vw € py, {w.,v) € R : Cip f^-j, lpj^{v) \=m 01 (induction hypothesis) 

<^ Mv &W, {w, v) e R: Cipj^(^yj),lpj^{v) \=m a (-C/j,^(^) is a submodel of /^/p^(,„)) 

<^ 'Czp^(u,),^PA4(^) Nm □" (= v) (construction of £,p^(^)) ■ 

For a PrLo instance {ip,Ai,w) one can compute lpj^{w) with the resources of NL (see [13]). 
It can be decided whether (9?, Cip r^^^, Ipj^i"^)) ^ PrLo-KMc with the resources of AC-*- [21]. 
With Claim [TOl it holds that {ip,Cip^(^^'j, Ipj^i^w)) G PrLo-KMc if and only if {ip,M,w) G 
PrLo-KMc. Since NL C AC^ it holds that PrLo-KMc G AC^ D 



A frame M — {W, R) is linear if for every toi, TO2 G W (with wi 7^ 1112) it holds that either (wi, «)2) G R 
or {w2,wi) £ R. 
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It is not known whether AC"^ also is the lower bound of PrLo-KMc. But from Leninias l2.2l 
and 13.81 the lower bound NL follows, even for the strictly implicational fragment. 

Lemma 4.6. The model checking problem for PrLp^ is NL-hard. □ 

Even though we do not know the exact complexity of FPLq-KMc and PrLo-KMc, it 
is a bit surprising that the LOGCFL upper bound we got for FPLq-KMc (Theorem 13. 7p is 
lower than the AC^ upper bound for PrLo-KMc (Theorem 14. 5p . 

5. Conclusion 

Now we are ready to state the P-completeness results for the model checking problems for 
intuitionistic logics and their modal companions. Overviews are given in Figures [7] and El 
We start with optimal results for intuitionistic logics. 

Theorem 5.1. The model checking problem is P-complete for FPL]^, KC2, IPC2, and 
BPLq. These results are optimal with respect to the number of variables. 

Proof. The upper bound from Theorem 12.11 carries over to all these fragments. The P- 
hardness for FPL^ comes from Theorem 13.31 for KC2 and IPC2 from Theorem 13.61 and for 
BPLq from Theorem 13.51 The optimality for FPL^-KMc follows from Theorem 13.71 where 
we show that FPLo-KMc is in LOGCFL. For IPC2-KMC and KC2-KMC it follows from [T9] 
where AC-^-completeness for IPCi-KMc and NC-^-completeness for KCi-KMc is shown. □ 

For the following results the optimality is still open. 

Theorem 5.2. The model checking problem is P-complete for KC^, IPC^, and BPL^. 

Proof. The upper bound from Theorem 12.11 carries over to all these fragments. The P- 
hardness for KC^ comes from Theorem 13.11 for IPC~^ from Corollary [321 ^^^ for BPL]^ 
from Corollarv 13.41 □ 

It is known that the validity problem for IPC^ even without using _L [25^ HI [28]. for 
FPL^ and BPL~* [4J, and for IPC2, FPLi, and BPLq [22] is PSPACE-complete. We show 
for all these fragments that model checking is P-complete. Even more, for the implicational 
fragments FPL{* and BPL^ with only one variable we reach P-completeness of model 
checking. Notice that no PSPACE-hardness results for the validity problem for implicational 
fragments with a bounded number of variables are known. 

Our P-completeness results for KC^-KMc and IPC~^-KMc hold also for the purely 
implicational fragments, i.e. KC~^ and IPC^ without using _L (resp. negation). But what 
happens if one bounds the number of variables in the implicational fragments? The model 
checking problem for IPC7* is NC^-complete [19] but for IPC7* with i > 1 it is open whether 
the complexity is below P. The fragments IPCj^ have finitely many equivalence classes of 
formulas and models [30l |8]. This equivalence class can be obtained with the resources 
of NC""", using a straightforward extension of the Boolean formula evaluation algorithm of 
Buss [3j. This might indicate an upper bound lower than P for the model checking problem. 
But it is not clear how hard it is to obtain the equivalence class of a given model. 

Another interesting open question is the complexity of BPL^-KMc. We expect the 
P-completeness of BPL^-KMc to be optimal. But in contrast to IPC^ even BPL,^ has 
infinitely many equivalence classes of formulas, because FPLfp already has it |32) . For FPLq, 
every equivalence class is represented by an implicational formula (see proof of Theorem l3.7p . 
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Figure 7: Complexity of the model checking problem for intuitionistic logics. 

(The ~^ indicates that the result holds for the implicational fragment. 



For BPLq*, it is clear that there are more equivalence classes, but it is open whether they 
can easily be represented. 

For the modal companions we conclude the following and start with the optimal results. 

Theorem 5.3. The model checking problem is P-complete for PrL^^, S4.2i, S4i, and K4o. 
These results are optimal with respect to the number of variables. 

Proof. For all these fragments the upper bound comes from Theorem 12.11 The P-hardness 
for PrL^, and K4o comes from Theorem 14.11 for S4.2i from Theorem 14. 21 and for S4i from 
Corollary 14.31 The optimality for PrLp"-KMc follows from Theorem 14.51 where we show 
PrLo-KMc G AC^ For S4.2i-KMc and S4i-KMc it follows from Lemma lOl where NC^- 
completeness for S4.2o-KMc and S4o-KMc is shown. D 

Notice that IPCi-KMc and KCi-KMc are the only cases where model checking for 
intuitionistic logics is easier than for its modal companions S4i-KMc and S4.2i-KMc. 
For the following results the optimality is still open. 

Theorem 5.4. The model checking problem is P-complete for S4.2^, S4^, and K4j^. 

Proof. For all these fragments the upper bound comes from Theorem 12 . 1 1 and the P-hardness 
comes from Theorem 14.11 □ 

Completeness results for S4.2~^-KMc and S4~^-KMc with a bounded number of vari- 
ables and for K4^ are still open. 

Another semantics for intuitionistic logics is the class of finite trees that are reflexive 
and transitive. This is a subclass of the intuitionistic Kripke models we used and also sound 
and complete for IPC. It is open whether the model checking problem for IPC over this 
tree-semantics is P-hard or below P, and it also remains open for the other P-complete 
model checking problems of this work. 
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Appendix A. 

Theorem 13.61 The model checking problem for KC2 and for IPC2 is P-hard. 

Proof We show IPC-KMc <m'^ KC2-KMC. Then P-hardness for KC2-KMC and IPC2-KMC 
fohows from Corollary 13.21 The construction is similar to the one given by Rybakov [2^ 
Theorem 4] for the PSPACE-completeness of the validity problem for IPC2- First of all we 
construct formulas with two variables which can be used for replacing the variables in arbi- 
trary IC formulas. We call them replacement formulas. Then we give generic models which 
have for every replacement formula a unique maximal refuting statqj. For a given instance 
of IPC-KMc~^ we transform the formula by replacing the variables with the replacement 
formulas and as model we take the union of the given model and a suitable generic model. 
This union eventually is a KC2 model. 

The construction — especially the base of the inductive definition of the replacement 
formulas — is very technical. Let p and q be the variables used in KC2. Figure [9] shows the 
top of the generic model. There, one can see in which states the variables p and q are satisfied 
(due to the valuation function of the model), and which are the maximal refuting states 
of the formulas to be defined in the sequel. The essential idea is that every replacement 
formula has exactly one state that is its maximal refuting state. 

Construction of the replacement formulas. The following formulas are the base for the 
inductive definition of the replacement formulas. 



In A^ = {W, R,(,) the state w refutes (p ii M,w ^\ ip. A state w € W is a maximal refuting state of ip 
if for all V € W \ {w} with {w, v) G R it holds that M, v \=] ip. 
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Figure 9: This is the top of the generic model with states from Wq U Wi. Every state 
is labelled below with the formula that it maximally refutes. (Transitive and 
reflexive edges are not depicted.) 



5i := p^ q 82 ■■= q^P 83 := pV q 

£1 ■■= S2 -> {61 V S3) £3 := (5i -> (^2 V 83) 

£2 := S3 -> {61 V 62) £4 := (ei A £2 A £3) -> {61 V ^2 V S3) 

Using these formulas, the first replacement formulas can be defined as follows. 






(ei Ae2) 
(ei Ae3) 
(ei A £4) 



(£3 V £4) 
(£2 V £4) 
(£2 V £3) 



/5l 



(£2 A £3) 
(£2 A £4) 
(£3 A £4) 



(£1 V £4) 
(£1 V £3) 
(£1 V £2) 



We call the upper index the level. The formulas on the next levels will be defined inductively. 
First we define n\ := 3 and n^+i := \Pk\ where Pk := {{x,y) \ 2 < x,y < n^}. With 
induction on k one can show that \Pk\ = {rik — 1)^- On level k we define a^ and f3^ for 
i = 1, 2, . . . , rifc. For the step from level k to level k + 1 we need an encoding {■ ,-)k from Pk 
to {1,2,..., {rik — 1)^} that is easy to compute and easy to decode. For example one can 
use the following: (• , ■)k maps (i, j) to {j — 1) + (n^ — 1) • (i — 2) for 2 < i,j < nt- For k >1 
the inductive definition is as follows. Let i, j G {2, 3, . . . , n^}. 



a 



fe+i 



ok+l 
P{i,j)k 



a^^ (/3j=Vaf V/3n 



/3i' 



af V a'y 



v/3n 



Construction of the generic models. For i > 1 we define the generic models TWf 

{wf,Rf,e). 
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Wo := {c, (ii,d2, (is, 61,62, 63,64 } 

Wk := { af, 6f I 1 < i < nfc } for 1 < A; < t 

t 

Wf := [jWi 

1=0 

In the following we give i?f . The accessibility relation Rxop of the first layers is shown in 
Figure [9j (Certainly we use the transitive and refiexive closure of the depicted edges.) For 
states from level > 2 the accessibility relation will be defined as follows. Let 1 < A; < t — 1. 

t 
R' := RTopU \J {RfURf). 

1=2 

In order to make the accessibility relation transitive, we add pseudo-transitive edges. Every 
state in a level is connected to every state at least two levels below. 

fc-2 

Tk ■■= Wfc X ( IJ Wi) for A: > 2 
1=0 
T is the union of all pseudo-transitive edges. 
t 
T := [JTi 
1=2 

We define the accessibility relation i?f as follows. 
Ri is the reflexive closure oiT VJ R' . 



Figure [10] shows a cutout of Mf- The valuation function ^^ is defined as follows (see 
Figure [9l). 

e^(p) := {c,di} 

e^(g) := {6,^2} 

The goal of the construction is that af (resp. /3f ) is not satisfied exactly in the states that 
see af (resp. b^). 

Claim 11. Let w he a, state of Mf- Then for all 1 < /c < t and i < n^ it holds that 
Mt ,w ^i a'l ^ {w,ai) G Rf and Mt,w ^\ /3f <^ (t^,6f) G Rf ■ 

The proof can be proceeded by an induction on k (similar as |22l Lemma 5]). Hence for 
every formula a^ and /3^ exists a unique maximal state in Aif that refutes this formula. 

Reduction from IPC^ model checking problem. For a given instance {(p,A4,w) of 
IPC^-KMc we show how to translate Ai and cp into M^ — a model over two variables — and 
(/?^ — a formula with two variables. Let 93 be a formula with variables vi,V2, ■ ■ ■ ,Vm and 
A4 = {W, R, ^) a model. We choose the smallest k > 1 such that n^ > m. To define c^^ we 
replace every occurrence of Vi in 99 by a^ V f3^ . 
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Figure 10: This is a cutout of the levels k — 2, k — 1 and fc of a generic model A^f where 
s = {i,j)k-i, i = {^■,h)k-2-, and k < t. The dashed grey edges are the pseudo- 
transitive edges. As we show in Claim [11] for example a^ ~ is the maximal 
refuting state for a^ ^ . (Reflexive edges are not depicted.) 



"f 



^[vi/a\ V fi'l][v2/al V P^] . . . [vrja^ V /3^ 



Since k < 1 + log(m) one can construct 93^ in logspace. We build the translation M^ 
{W'^,R^,S,'^) as a union of M and M^. 



W 



W^W^ 



The accessibility relation i?^ is constructed such that \i w ^ C{vi), then {w,af) G R^ and 
{w,bf) G R^. Hence w refutes a^ V f5f — the translation of Vi. 

In order to make R^ transitive and give a logspace computable construction we connect 
every state of 7W with every state in TW'^ on level k — 1 and below. 

fc-i 

Rtrans := W X [j Wi 



We define the accessibility relation R^ as follows. 
R"^ is the reflexive closure of Rfu RU R^U R 



trans ■ 



As valuation function we use 

e := e. 

The valuation function ^ of A^ is simulated by the edges between Ad and M from R^. 
The model M."^ is a KC2 model because for every state u € W'^ it holds that (u, c) G R?. 
(The proof of the following claim bases on the proof of \2% Lemma 7].) 

Claim 12. For allw&W it holds that M,w \=\ Lp if and only if M'^,w \=\ ip^ . 
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Proof of Claim. We prove this by induction on the construction of 93. For the initial step 
let if = vi he a variable with 1 < I < m, hence ip'^ = af V f^^ . li A4,w ^\ vi, then w is via 
R^ (resp. R^) connected to a^ and 6f. With Claim [TT] it follows that M'^.w \l=\ af V j3f. 
Now assume that M'^,w ^j a^ V I3f with w G W . Since 



af = a^-i ^ ( /3f-i V af-i V /J^-^ ) and 



for {i,j)k-i = I it holds that there are some states w',w" G W'^ with {w,w') € .R^ and 
(w, w") G i?^ and 

TW^^ti;' hai"^ and TW^^u;' ^ /3f~W af-^ V /J^-^ and 
7W2, w;" ^i /3f-i and A^^^ u;" ^i a^"^ V a^^ V /3^^-\ 

From Claim [TT] follows that A^2,a^_|_i ^\ /3f~^ and Al^,6^^_^ ^i a^~^ Hence it follows 
for every u £ W that 7W^,n ^i a^~^ and 7W^,n ^i /3^~^ because (u,a^^;^) G i?^ and 
{u,b^^i) G i?^. Therefore w',w" G M^;f- Furthermore note that w' and ty" are in level k 
of Al^ because w' refutes af and w" refutes (3J^ and with Claim [TT] it follows that w' = of 
and w" = bf. From {w,af) G R^, {w,bf) G R^, and the construction of R^ it follows that 
If ^ C(''^/)- Hence TVij-u; ^j vi. 

For the induction step let tp = ji<6 with -k G {A, V, ->}. We show that M'^,w \=\ (7*5)^ 
if and only if M,w \=\ 7 * (5. (Note that (7 * 6)'^ = 7^ • S"^.) For the cases that * = A and 
• = V this follows directly from the definition of the satisfaction relation |=|. Now consider 
Lf = J -> 6 and A4,w ^\ p. Then there is some state w' € W with A4,w' \=\ 7 and 
M,w' ^i 6. By induction hypothesis it follows that M'^,w' \=\ 7^ and M'^,w' ^\ 5"^. 
Hence M^^w ^\ pP' . For the other proof direction let i/; G VF with A^^,tt; ^j Lp^ . Then 
there is a t;;' G VF^ with {w,w') G R^ and M'^,w' \=\ 7^ and M'^,w' ^\ 5"^. The formulas 
aj V /3]^, al V /^l , . . . , a^ V /3m ^^^ satisfied in every state of level k and below, because every 
state in level k refutes exactly one a^ respectively /3j formula. (The states below level k 
satisfy all formulas on level k.) In 5^ every variable Vi from 5 is replaced by the disjunction 
of an a^ V fi^. Hence 5"^ is satisfied in every state in W^ . In order that w' refutes 5"^ , it 
holds that w' G W. By induction hypothesis we obtain that A4,w' \=\ 7 and Ai,w' ^\ 5. 
From w,w' ^W and {w,w') G R^ it follows that {w,w') G R. Hence M-,w ^\ p. ■ 

The reduction function is the mapping 

(ipMM ' — ^ ((/J^^1^^(;) 

where {ip,Ai,w) is an instance of IPC^-KMc. Claim [12] shows that A4,w \=\ ip if and only 
if A4'^,w \=\ p^ . It follows directly from the construction that this is a logspace reduction. 
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